Repository navigation
fix(dev): family audit on cli-core 0.648.0, fewer network lint false positives, shared hosts in the manifest - #573
Merged
Conversation
…positives, shared hosts in the manifest
- shared-command-contract: cli-core 0.648.0 marks the commands it mounts `origin: "cli-core"` in
`commands --json`, while their contract keeps the origin they were written with. The audit took the
mark as a change, so `cli-dev audit --family` failed on every shared command (88 in b24). The mark now
counts as the contract's own origin; any other origin change still fails. With clean contracts, b24's
shared commands are protected again, so the `doctor reports` wording the published max, tg and wa
still carry is accepted as inherited: no baseline entry needed. Reproduced against bitrix24-cli main
(cli-core 0.648.0) in a throwaway HOME: 90 blocking findings before, exit 0 after.
- undeclared-host: only a URL that starts a string counts. Help links in sentences, API descriptions
and markdown links are printed, never fetched. schemas.openxmlformats.org joins the namespace names
skipped by name. Checked on mail, drive, memo, zoom, max, tg, wa, gcal and b24: no declared host is
lost; drive drops 9 of 11 baseline hosts, mail 6 of 17 overrides.
- raw-network: `fetch` destructured in an arrow's or a method's parameter binds the injected one
(memo's readers); `call({ fetch })`, `() => ({ fetch })` and a ternary argument are still reported.
Old vs new over 14 checkouts: only memo main's ollama.ts stops being reported, and it binds fetch.
- cli-dev manifest: `network.hosts` adds SHARED_HOSTS (registry.npmjs.org, huggingface.co,
*.huggingface.co, *.hf.co, github.com, *.githubusercontent.com): the update check and cli-core's model
and runtime downloads, with the redirect hosts checked by a HEAD request on each source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
leemour
added a commit
that referenced
this pull request
Nov 13, 2026
…audit (#574) ## Task Owner ruling NEED-2578 A: the family audit rules `same-entity-schema` and `same-error-reason` must fail, not warn. Ships in 0.99.0 with #573. ## Why 0.98.0 printed their findings as warnings, so a new divergence between CLIs went unnoticed. ## What - `cli-dev audit --family` fails on new findings of both rules. - Today's 11 differences are declared as parity-group differences with `review_after: 2026-11-27` and a reason each, so no published CLI turns red today: - `messengers`: `entity contact_context`, `entity contact_preparation`, `entity linked_person` (max, tg, wa) - `gcal-shared`: `entity api_method`, `entity scheduled_job`, `entity hit`, `entity deal`, `entity lead`, `entity product`, `reason ai.address-refused=model.address-refused`, `reason profile.unknown: code` - A difference of these two rules names no CLI list. Which CLIs share an entity or reason changes with each publish (zm joined the address finding within an hour), so a listed target would go stale. The `review_after` date retires it instead of a stale check. - `oauth.missing` vs `session.missing` is not a finding today, so it has no row. ## Testing - Family audit from bitrix24-cli main (cli-core 0.648.0, throwaway HOME, `DBUS_SESSION_BUS_ADDRESS=disabled:` on the CLI runs): exit 0, 0 new findings for any of the 9 CLIs. - New test: an unlisted difference accepts its finding, and another entity still blocks. - `vitest run` (68 files, 1117 tests), typecheck, biome, `docs:check`, `docs:lint`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Merged
leemour
added a commit
that referenced
this pull request
Nov 13, 2026
Dates the changelog and raises the version for #573 and #574. Only package.json and the CHANGELOG heading change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task
Follow-up fixes found while the WireCat CLIs adopted cli-core 0.648.0. CLIs need these on npm.
Why
cli-dev audit --family(0.98.0) failed for every CLI on cli-core 0.648.0. cli-core now marks the commands it mountsorigin: "cli-core"incommands --json; the contract they are compared with keeps the origin they were written with.shared-command-contractread the mark as a change: 88 findings in b24, plus 2doctor reportswording findings against the published max, tg and wa.undeclared-hostflagged URLs that are only printed (help links in sentences, API descriptions, markdown links): mail carried extra overrides, drive 11 baseline hosts.raw-networkflagged afetchdestructured in an arrow parameter (memo's readers had to rename it).cli-dev manifestleft out the hosts cli-base and cli-core reach for every CLI (update check, model and runtime downloads), so Desktop did not show them.What
shared-command-contracttakes thecli-coreorigin mark as the contract's own origin; any other origin change still fails. With clean contracts, b24's shared commands are protected again, so the existing inherited-difference rule accepts the published max/tg/wadoctor reportswording. No baseline orreview_afterentry needed.undeclared-hostcounts a URL only when it starts a string.schemas.openxmlformats.orgjoins the namespace names skipped by name. Help links and OAuth scopes alone in a string still need an override: nothing tells them apart from a request's address.raw-network: an arrow's or method's destructuredfetchparameter binds it;call({ fetch }),() => ({ fetch })and ternary arguments stay reported.SHARED_HOSTS(registry.npmjs.org,huggingface.co,*.huggingface.co,*.hf.co,github.com,*.githubusercontent.com) added tonetwork.hostsbycli-dev manifest, exported from@wirecat/cli-base/wcat/manifest. Redirect hosts checked with a HEAD request on each source.Downstream after the bump:
pnpm generate(manifest changes), and drop the stale lint entries: drive 9undeclared-hostbaseline hosts, mail 6 overrides (account.apple.com, e.mail.ru, id.yandex.ru, mail.yandex.ru, myapps.microsoft.com, www.microsoft.com). memo may undo itsfetch: sendrename.Testing
DBUS_SESSION_BUS_ADDRESS=disabled:: 98 blocking (90 failing) before, exit 0 after.ollama.tschanges, and it bindsfetch.pnpm typecheck,biome check(changed files clean),vitest run(68 files, 1116 tests),docs:check,docs:lint,standards:check.🤖 Generated with Claude Code